Chaotic system anomaly response by artificial intelligence

ABSTRACT

A system for detecting and responding to an anomaly in a chaotic environment, comprising one or more autonomous agent devices and a central server comprising a processor and non-transitory memory. The memory stores instructions that cause the processor to receive a first set of sensor readings from one or more remote electronic sensors, during a first time window, the sensor readings recording pseudo-Brownian change in one or more variables in the chaotic environment; determine, based on the first set of sensor readings, an expected range of the one or more variables during a second time window after the first time w window; receive a second set of sensor readings from the one or more remote electronic sensors during the second time window recording change in the one or more variables: determine, based on the second set of sensor readings, that one variable of the one or more variables is not within the expected range; and cause the one or more autonomous agent devices to attempt to mitigate a potential harm indicated by the one variable being outside of the expected range.

CROSS REFERENCE TO RELATED APPLICATION

This application is a continuation of U.S. patent application Ser. No.16/264,671, filed on Jan. 31, 2019 and also titled “Chaotic SystemAnomaly Response By Artificial Intelligence”, which is herebyincorporated by reference in full.

FIELD OF INVENTION

This application relates to artificial intelligence methods and systems,and more specifically, for methods and systems for an artificialintelligence to analyze sensor data from a chaotic environment and toaffect that environment.

BACKGROUND

In 1827, Robert Brown discovered some of the first evidence of themolecular theory of matter by observing how pollen particles in waterwere pushed back and forth in an unpredictable manner by impacts withinvisible water molecules bouncing off one another. As observationdevices have improved in quality, it has been discovered that allfluids, despite being made up of individual molecules which travel instraight lines when unimpeded by collision with other molecules, arehighly chaotic due to the presence of countless collisions constantlychanging the momentums of those molecules.

Brownian motion, the nature of movement of an individual particle inthis chaotic fluid system, has been extensively analyzed within themathematical fields of statistical physics, applied physics, andtopology. Further, a number of non-fluid systems have been found to orhypothesized to be modellable as if undergoing Brownian motion, such asthe movement of stars within a galaxy, or the change of value of aninvestment asset in a marketplace.

SUMMARY OF THE INVENTION

Disclosed herein is an artificial-intelligence system for detecting andresponding to an anomaly in a chaotic environment, comprising one ormore autonomous agent devices and a central server comprising aprocessor and non-transitory memory. The memory stores instructionsthat, when executed by the processor, cause the processor to receive afirst set of sensor readings from one or more remote electronic sensors,during a first time window, the sensor readings recordingpseudo-Brownian change in one or more variables in the chaoticenvironment; determine, based on the first set of sensor readings, anexpected range of the one or more variables during a second time windowafter the first time window; receive a second set of sensor readingsfrom the one or more remote electronic sensors during the second timewindow recording change in the one or more variables; determine, basedon the second set of sensor readings, that one variable of the one ormore variables is not within the expected range (and thus, whether it ispresumed to be so unlikely to be the result of pseudo-Brownian motionthat it likely to be non-Brownian motion instead); and cause the one ormore autonomous agent devices to attempt to mitigate a potential harmindicated by the one variable being outside of the expected range.

Further disclosed is an artificial-intelligence method for detecting andresponding to an anomaly in a chaotic environment comprising receiving afirst set of sensor readings from one or more remote electronic sensors,during a first time window, the sensor readings recordingpseudo-Brownian change in one or more variables in the chaoticenvironment; determining, based on the first set of sensor readings, anexpected range of the one or more variables during a second time windowafter the first time window; receiving a second set of sensor readingsfrom the one or more remote electronic sensors during the second timewindow recording change in the one or more variables; determining, basedon the second set of sensor readings, that one variable of the one ormore variables is not within the expected range; and causing the one ormore autonomous agent devices to attempt to mitigate a potential harmindicated by the one variable being outside of the expected range.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 depicts a computing system for receiving distributed sensorreadings of a chaotic environment and directing agents in response tochanges in the chaotic environment;

FIG. 2 depicts a possible projection of expected behavior in a chaoticsystem with pseudo-Brownian motion;

FIG. 3 depicts a method for an artificial intelligence system to processthe incoming sensor data and direct the agents in the chaoticenvironment;

FIG. 4 depicts an actual graph showing sensor readings and changes inexpected ranges over a period of lime as the expected ranges arerepeatedly re-computed after conclusion of a new time window;

FIG. 5 depicts an actual graph showing sensor readings over a period oftime as a variable experiences a sudden decrease and return to normalcy;and

FIG. 6 depicts a general computing device for performing a number offeatures described above.

DETAILED DESCRIPTION

FIG. 1 depicts a computing system for receiving distributed sensorreadings of a chaotic environment and directing agents in response tochanges in the chaotic environment.

A chaotic system having a number of discrete “active” entities thatinfluence each other or that influence “passive” entities within thesystem may be described as exhibiting pseudo-Brownian motion of thoseactive or passive entities. The more simple the behavior of the entitiesbeing described, the more likely that the overall behavior of entitiesin the environment will match that of a true Brownian motionenvironment: the behavior of air or water currents may be betterapproximated than the behavior of birds in a flock, which may be betterapproximated than the behavior of humans in a crowd. The motion alsoneed not be of a physical matter, as opposed to a value; for example,the number of data connections being maintained by a networking devicemay vary in response to users' independent behavior (each user's choiceto initiate a connection) and users' dependent behavior (each user'schoice to terminate a connection because of network congestion renderingthe network useless). In this example, impatient and patient usersentering and leaving the network at various times may be abstracted asif high- and low-velocity molecules jostling one another in a fluid, sothat the network congestion level itself experiences pseudo-Brownianmotion.

Turning now to the elements of FIG. 1, a central server 100 receivessensor data from a number of remote electronic sensors 105 in a chaoticenvironment via a network 110 and transmits instructions to a number ofelectronic computing device agents 115 via network 110.

Network 110 may be, for example, the Internet generally, a localwireless network, an ethernet network or other wired network, asatellite communication system, or any other means of connecting thesensors 105 to the central server 100 and the central server to theagents 115 to enable data transmissions. Moreover, network 110 may notbe a single network, as pictured, rather than a number of separatenetworks: for example, a central server 100 could have a number ofproximal sensors 105 to which it is attached by wired connections, anumber of nearby sensors 105 to which it connects via a Wi-Fi network,and a number of extremely remote sensors 105 to which it connects via asatellite. Connections may avoid the use of a network entirely, and usedirect wired or wireless transmission to send data to and from centralserver 100. As depicted in FIG. 1, arrows show the expected direction ofdata flow to and from the network.

Sensors 105 may be any types of electronic sensors that register datafrom a chaotic environment external to the central server 100. Examplesensor types for particular embodiments may include, but are not limitedto, cameras, thermometers, GPS tracking devices or other geolocationdevices, sensors of motion/distance/acceleration/orientation, orcommunications modules receiving electronic data communications from asource.

Agents 115 may be any form of computing device able to cause a change inthe chaotic environment, or able to cause a change in another “realworld” system that is influenced by the chaotic environment. Forexample, an agent 115 could be a computing device that triggers aphysical alarm, that pilots a drone aircraft or autonomous vehicle, thatroutes network traffic, that generates messages for display on physicaldevices associated with human users, or that performs other actionsassociated with “smart appliances” or other automated systems.

A number of possible pairings of sensors 105 and agents 115 to achieveparticular purposes are described below.

In one example embodiment, sensors 105 may include thermometers atvarious locations internal to a computer or within a server room, andagents 115 may be climate control fans or air conditioners. A system mayprevent physical damage to computers and improve computer performance byusing the sensor data to determine whether upticks in observedtemperature are likely to be random variations or substantive issues,such as a blocked fan grate or overheating component. In response to anissue, additional cooling systems may be activated or increased inpower, automated alarms may be triggered, and human operators of asystem may be notified of the unexpected change in temperature.

In another example embodiment, sensors 105 may be outdoor thermometersmeasuring temperature throughout a city or landscape. A system mayprevent inaccurate weather reporting data by using data from thethermometers to determine that a change in observed temperature is notweather-related, but rather human-caused (such as operation of anexhaust fan for heated air near a thermometer, or the existence of abonfire near a thermometer) and automatically notify a weather servicethat the data from particular sensors should be excluded or treated withcaution.

In another example embodiment, sensors 105 may include GPS trackers on anumber of animals, or cameras recording the locations of animals in anature preserve. Aberrant behavior in the animals' movements mayindicate the presence of poachers, environmental hazards, or unwantedpredators in the nature preserve that are causing the animals to move ina manner different front a usual pattern of grazing and movement withina herd. Agents 115 may be aerial drones sent to observe the situationand report data back to park management, or personal devices or alarmsused by park management to warn them that a human should be sent toinvestigate the situation.

In another example embodiment, sensors 105 may include GPS trackers in anumber of automobiles. The flow of traffic may be modeled as apseudo-Brownian motion of cars “bouncing off” one another by brakingwhen they approach one another too closely, once a “drift” variable isincluded to normalize the calculations by subtracting the average speedof the flow of traffic during all calculations. Agents 115 may includeautomated systems for managing traffic (such as traffic lights oradditional traffic lanes that may be opened or closed), autonomousvehicles themselves, or personal devices or alarms used by drivers,police, or other first responders. In response to a traffic jam, roadhazard, unexpected traffic volume, or other issue influencing a naturalflow of traffic, various automated systems may be directed to changebehavior in a way that reduces impedance of traffic, and human actorsmay be alerted to the issue to inform their choices as well.

In another example embodiment, sensors 105 may include one or morecameras tracking the locations of a number of people in a public space,like a shopping center. Agents 115 may include a fire alarm or otheralarm system, a cleaning robot, or a computer system capable ofgenerating messages to direct human workers. Behavior of people thatdiverges significantly from “milling about” or from heading in a generaldirection while avoiding contact with other people may indicate apassive hazard, such as a liquid spill or noxious smell that isinfluencing people to take a longer path to avoid the hazard, or anactive danger such as a lire or person with a weapon, from whom peopleare fleeing. In response, the system may automatically attempt todetermine the cause of the hazard, trigger an alarm if necessary, anddirect automated or human resources to address the hazard.

In another example embodiment, sensors 105 may include firewalls orrouters at the edge of a computer network, reporting an incoming numberof network packets, while agents 115 may include servers in a servercluster, routers, or firewalls. A system may select the beginning of adenial of service (DDOS) attack by distinguishing an increase in networktraffic from a natural variation in the incoming traffic, and eitheractivate more servers to handle the attack or shut off an inflow ofnetwork traffic until the attack ceases.

Similarly, sensors 105 may report total usage of resources on a device,such as load on a CPU (central processing unit), network card, ormemory. Agents 115 may include a kernel or operating system process forshutting down or throttling software that is using an excessive orincreasing proportion of system resources, by determining that an uptickin resource usage is indicative of a program bug or malicious softwaredesign, rather than a natural variance during intended use of thesoftware. The operating system process may then be able to respond byautomatically terminating the software, throttling resources availableto the software, sandboxing the software to isolate it from other systemcomponents, or generating a warning for a human user of the software.

In another example embodiment, sensors 105 may include trackers ofnetwork traffic flow to a particular resource, such as the page for aparticular movie on a streaming service or the page for a particularproduct on an e-commerce site, while agents 115 may include serverswithin the streaming service or automated warehousing elementsassociated with the e-commerce website. A system may detect thebeginning of a surge in popularity for the given resource or item (suchas that triggered by a celebrity endorsement or other unexpectedcultural or economic change), and begin directing a content deliverynetwork to distribute an electronic resource more widely, or may directautomated warehousing elements to move an item's storage location to bemore efficiently shipped from the warehouse.

In another example embodiment, sensors 105 may include devices at astock exchange or other market reporting the current buy or sell pricesof one or more assets. Agents 115 may include computing devices capableof transmitting buy or sell orders to the market, or firewall devicescapable of preventing such computing devices from successfullytransmitting a buy or sell order to the market. In response to a marketanomaly, the ability of traders to trade may be automatically stopped bythe computing devices themselves, or traders may be notified of theanomaly so they may proceed with greater caution.

The determination that variations in observed sensor values indicate anissue that must be addressed by one of the agents 115 is made at leastin part on observation of sensor values outside an expected range (asdepicted in FIG. 2) determined by an artificial intelligence analysis ofpast and present sensor values (as depicted in FIG. 3 and describedfurther below),

FIG. 2 depicts a possible projection of expected behavior of a sensedvalue in a chaotic system with pseudo-Brownian motion.

The simplified graph of FIG. 2 shows observed historical sensor values205 and predicted future sensor values 210. An expected range 215,including an upper range 216 and a lower range 217, bounds the predictedfuture sensor values 210, expanding over time (axis 220) as uncertaintyincreases due to the extra time available for the sensor values torandomly or pseudo-randomly change.

Expected range 215 represents a confidence interval such that, ifchanges to the sensor value are and remain driven by a pseudo-Brownianmotion without active interference, the observed sensor values in thefuture are less likely to exceed the interval than some threshold value.For example, in one embodiment, a sensor value may be expected with 95%probability not to leave the expected range 215 without someunaccounted-for factor influencing the underlying chaotic environmentbeing sensed by sensors 105. In another embodiment, the expected range215 may be wider, and represent a 99%, or 99.9%, or even higherprobability that sensor values will not leave the range without activeinterference. Examples of these varying confidence intervals areillustrated in FIG. 4, below.

As illustrated in FIG. 2, the observed and predicted sensor values 205and 210 are single scalar values, so a cross-section perpendicular toevery point along the time axis 220 of expected range 215 is a verticalline, and expected range 215 is essentially a two-dimensional wedge witha point at the present. In other embodiments, sensor values 205 and 210may be multidimensional. For example, if two sensor values are measuredin tandem, expected range 215 would be a three-dimensional pyramid orcone with its point at the present, having a cross-section with respectto time axis 220 that is two-dimensional and representing the expectedrange of possible pairs of the two sensor values. Higher-dimensionalexpected ranges for the values of multiple sensor values could beextrapolated (though not easily illustrated) based on the sameprinciple.

Although the boundaries 216 and 217 of the expected range 215 aredepicted here as straight lines, curves or other non-linear boundaries(or non-planar non-hyperplanar boundaries in higher dimensionembodiments) may bound expected range 215, depending on characteristicsof the chaotic environment or sensitivity of the system to an anomaly.

FIG. 3 depicts a method for an artificial intelligence system to processthe incoming sensor data, generate the graph of FIG. 2 and direct theagents in the chaotic environment in response to subsequent sensorreadings exiting the expected range.

At the beginning of each of a series of time windows, one or more sensorreadings are received by the central server 100 from the sensors 105(Step 300). The time windows may be tailored to a specific embodimentand represent any period of time from several minutes when measuring themovement of animals, to several seconds in measuring the temperature ofa system or the movement of people, to minute fractions of a second whenmonitoring vehicle movements, network flow, resource usage, orfluctuations in asset price.

Any detected drill term (i.e., that all the sensor readings areexperiencing a systemic shift in one direction, as may occur in someembodiments) is removed from the data (Step 305). For example, asmentioned above, the locations of vehicles in a traffic jam may changenot only in response to one another and to hazards, but will alsoconstantly be changing at about the average velocity of the trafficflow. As a result, sensor readings including the vehicles' overallvelocity should be normalized by subtracting the drift term, the averagetraffic speed. After normalization, some vehicles will have negativevelocities with respect to the flow and others positive, as one mightexpect from looking at the positive and negative velocities in a givendirection of fluid particles within a container. Similarly, in an upwardtrending market subsequent to good economic news, a drift term may needto be isolated and removed in order to determine whether a particularasset price change is anomalous or in line with market trends.

Other actions may be taken to normalize data from sensor readings ofdifferent types or as otherwise needed in a given embodiment.

Then, looking at the normalized sensor readings from previous timewindows, a bipower variation is calculated (Step 310) according to theequation

=Σ_(i∈ω) |s(t _(i))∥s(t _(i−1))|where s(t) is a sensor reading at time window t. Lowercase sigmarepresents a volatility estimator, an analogue to standard deviation inthe sensor data calculated by the bipower variation.

Based on the calculated standard deviation and a desired risk tolerancefor a particular application, an expected range is calculated for one ormore coming time windows, given the assumption that a variable isundergoing pseudo-Brownian motion (Step 315). For example, a confidenceinterval of 90% that a variable is undergoing pseudo-Brownian motion isusually computed by determining a range of roughly to plus or minus foursigma from the mean sensor value, while a confidence interval of 99.9%may correspond roughly to plus or minus six sigma from the mean sensorvalue.

More specifically, a confidence interval that a variable's change ispseudo-Brownian rather than non-Brownian may be constructed by choosingL, a ratio of a sensor reading to sigma that should be considered alikely anomaly, such that P(anomaly)=exp(−exp((C(n)−L)/S(n))), whereC(n) is a function equal to ((2 log n)^(1.5)/c)−((log pi+log log n)/2c(2log n)^(0.5)), n is the total number of windows and thus also the indexof the current window, c is the constant sqrt(2/pi), and S(n) is afunction equal to 1/c(2 log n)^(0.5).

If each incoming sensor reading is within the confidence interval (Step320), no action is taken save a return to receiving new sensor readingsin a next time window and recalculating the expected range (repeatingSteps 300-315). If an anomalous sensor reading is detected, centralserver 100 may generate a message for transmission to one or more of theautonomous agents 115 (Step 325), which may then further act asconfigured for harm minimization according to the application of theanomaly detection system (Step 330). Regardless of the actions of theautonomous agents 115, central server 100 continues to review sensordata to determine whether additional anomalies exist, or whether furthersensor data seems to indicate a “new normal” for volatility in thechaotic system and subsequent adjustment of the expected ranges, asillustrated in FIG. 4.

FIG. 4 depicts an actual graph showing sensor readings and changes inexpected ranges over a period of time as the expected ranges arerepeatedly re-computed after conclusion of a new time window.

Expected maximum 216 and minimum 217 represent 99.9% confidenceintervals that sensor readings, plotted with dots at 400, 401, 402 andelsewhere throughout FIG. 4 will fall within if influenced solely bypseudo-Brownian motion and not by an external, non-Brownian influence.

Rather than being linear as displayed in FIG. 2, the expected maximumand minimum 216 and 217 vary over time based on re-computation of pastand present data, such that FIG. 4 effectively represents taking a smallslice of every single projection occurring immediately after the presenttime in that projection. As variation in the sensor readings 400increases or decreases during windows of time, the range between theexpected maximum and minimum at those points in time accordingly widenedand narrowed.

At two points in time (around the sensor readings 401 and 402),volatility in sensor readings 400 increased significantly, so much thatthe sensor readings 401 and 402 are above and three additional readingsat around the same lime are below the confidence intervals of 216 and217, respectively. These outlier data points strongly indicate an activeinterference of some kind in the normal function of the chaoticenvironment and might be the basis of action by autonomous agents 115.

Both because the outliers might, however unlikely, be sensor readingsnot affected by a system anomaly, and because other later sensorreadings may nonetheless be affected by the chaotic system interferedwith, the confidence interval expands significantly after outliers 401and 402 to prevent false alarms from subsequent sensor readings that mayrepresent normal chaotic behavior after such a disturbance in thesystem.

FIG. 5 depicts an actual graph showing sensor readings over a period oflime as a variable experiences a sudden decrease and return to normalcy.

Throughout most of a time period that three variables 500 are undergoingchange, the L ratio remains below 4 at almost all times because thevariables 500, while noisy, are not dramatically changing within anysmall time window. However, at time 501, there is a sudden andprecipitous drop in one of the three variables, causing the L ratio tospike to approximately 10, which demonstrates a very high likelihoodthat the change was not another example of random noise orpseudo-Brownian motion in the variable's change. As a result, a systemmonitoring the changes of these variables should trigger and takeautomatic action as necessary.

At time 502, another sudden change occurs, causing the L ratio toincrease even further, to a value of approximately 14. However, in thiscase, the system should not necessarily lake action, despite theincredibly high L value, because the L value has been skewed by theperiod of a lower and more stable measured variable 500. The jump attime 502 likely represents a reversion to the mean and perhaps the endof an abnormal influence on the variable 500, not a new secondaryinfluence further distorting it.

The decision by the system to take or refrain from automated action maybe influenced not only by the statistical analysis of the incomingsensor data over a short time window, hut also on sensor data over longwindows or on supplemental sensor data or information feeds that do notreport the variable 500 values directly, but do report information thatmay influence it and may help to analyze whether a second disturbance ina variable's value is a reversion to the mean or not. Selection of alonger time window for data analysis may help to avoid the systemoverreacting to a sudden change and reversion/self-correction, but alsoruns the risk of making the system less responsive to changes that willnot self-correct. Empirical testing with a given embodiment may helpwith determining a window size and number of successive windows to useto optimize the tradeoff between unnecessary action and undesiredinaction.

FIG. 6 is a high-level block diagram of a representative computingdevice that may be utilized to implement various features and processesdescribed herein, for example, the functionality of central server 100,sensors 105, or autonomous agents 115. The computing device may bedescribed in the general context of computer system-executableinstructions, such as program modules, being executed by a computersystem. Generally, program modules may include routines, programs,objects, components, logic, data structures, and so on that performparticular tasks or implement particular abstract data types.

As shown in FIG. 6, the computing device is illustrated in the form of aspecial purpose computer system. The components of the computing devicemay include (but are not limited to) one or more processors orprocessing units 900, a system memory 910, and a bus 915 that couplesvarious system components including memory 910 to processor 900.

Bus 915 represents one or more of any of several types of busstructures, including a memory bus or memory controller, a peripheralbus, an accelerated graphics port, and a processor or local bus usingany of a variety of bus architectures. By way of example, and notlimitation, such architectures include Industry Standard Architecture(ISA) bus. MicroChannel Architecture (MCA) bus. Enhanced ISA (EISA) bus.Video Electronics Standards Association (VESA) local bus, and PeripheralComponent Interconnect (PCI) bus.

Processing unit(s) 900 may execute computer programs stored in memory910. Any suitable programming language can be used to implement theroutines of particular embodiments including C, C++, Java, assemblylanguage, etc. Different programming techniques can be employed such asprocedural or object oriented. The routines can execute on a singlecomputing device or multiple computing devices. Further, multipleprocessors 900 may be used.

The computing device typically includes a variety of computer systemreadable media. Such media may be any available media that is accessibleby the computing device, and it includes both volatile and non-volatilemedia, removable and non-removable media.

System memory 910 can include computer system readable media in the formof volatile memory, such as random access memory (RAM) 920 and/or cachememory 930. The computing device may further include otherremovable/non-removable, volatile/non-volatile computer system storagemedia. By way of example only, storage system 940 can be provided forreading from and writing to a non-removable, non-volatile magnetic media(not shown and typically referred to as a “hard drive”). Although notshown, a magnetic disk drive for reading from and writing to aremovable, non-volatile magnetic disk (e.g., a “floppy disk”), and anoptical disk drive for reading from or writing to a removable,non-volatile optical disk such as a CD-ROM, DVD-ROM or other opticalmedia can be provided. In such instances, each can be connected to bus915 by one or more data media interfaces. As will be further depictedand described below, memory 910 may include at least one program producthaving a set (e.g., at least one) of program modules that are configuredto carry out the functions of embodiments described in this disclosure.

Program/utility 950, having a set (at least one) of program modules 955,may be stored in memory 910 by way of example, and not limitation, aswell as an operating system, one or more application software, otherprogram modules, and program data. Each of the operating system, one ormore application programs, other program modules, and program data orsome combination thereof, may include an implementation of a networkingenvironment.

The computing device may also communicate with one or more externaldevices 970 such as a keyboard, a pointing device, a display, etc., oneor more devices that enable a user to interact with the computingdevice: and/or any devices (e.g., network card, modem, etc.) that enablethe computing device to communicate with one or more other computingdevices. Such communication can occur via Input/Output (I/O)interface(s) 960.

In addition, as described above, the computing device can communicatewith one or more networks, such as a local area network (LAN), a generalwide area network (WAN) and/or a public network (e.g., the Internet) vianetwork adaptor 980. As depicted, network adaptor 980 communicates withother components of the computing device via bus 915. It should beunderstood that although not shown, other hardware and/or softwarecomponents could be used in conjunction with the computing device.Examples include (but are not limited to) microcode, device drivers,redundant processing units, external disk drive arrays, RAID systems,tape drives, and data archival storage systems, etc.

The descriptions of the various embodiments of the present inventionhave been presented for purposes of illustration, but are not intendedto be exhaustive or limited to the embodiments disclosed. Manymodifications and variations will be apparent to those of ordinary skillin the art without departing from the scope and spirit of the describedembodiments. The terminology used herein was chosen to best explain theprinciples of the embodiments, the practical application or technicalimprovement over technologies found in the marketplace, or to enableothers of ordinary skill in the art to understand the embodimentsdisclosed herein.

The present invention may be a system, a method, and/or a computerprogram product at any possible technical detail level of integration.The computer program product may include a computer readable storagemedium (or media) having computer readable program instructions thereonfor causing a processor to carry out aspects of the present invention.

The computer readable storage medium can be a tangible device that canretain and store instructions for use by an instruction executiondevice. The computer readable storage medium may be, for example, but isnot limited to, an electronic storage device, a magnetic storage device,an optical storage device, an electromagnetic storage device, asemiconductor storage device, or any suitable combination of theforegoing. A non-exhaustive list of more specific examples of thecomputer readable storage medium includes the following: a portablecomputer diskette, a hard disk, a random access memory (RAM), aread-only memory (ROM), an erasable programmable read-only memory (EPROMor Flash memory), a static random access memory (SRAM), a portablecompact disc read-only memory (CD-ROM), a digital versatile disk (DVD),a memory stick, a floppy disk, a mechanically encoded device such aspunch-cards or raised structures in a groove having instructionsrecorded thereon, and any suitable combination of the foregoing. Acomputer readable storage medium, as used herein, is not to be construedas being transitory signals per se, such as radio waves or other freelypropagating electromagnetic waves, electromagnetic waves propagatingthrough a waveguide or other transmission media (e.g., light pulsespassing through a fiber-optic cable), or electrical signals transmittedthrough a wire.

Computer readable program instructions described herein can bedownloaded to respective computing/processing devices from a computerreadable storage medium or to an external computer or external storagedevice via a network, for example, the Internet, a local area network, awide area network and/or a wireless network. The network may comprisecopper transmission cables, optical transmission fibers, wirelesstransmission, routers, firewalls, switches, gateway computers and/oredge servers. A network adapter card or network interface in eachcomputing/processing device receives computer readable programinstructions from the network and forwards the computer readable programinstructions for storage in a computer readable storage medium withinthe respective computing-processing device.

Computer readable program instructions for carrying out operations ofthe present invention may be assembler instructions,instruction-set-architecture (ISA) instructions, machine instructions,machine dependent instructions, microcode, firmware instructions,state-setting data, configuration data for integrated circuitry, oreither source code or object code written in any combination of one ormore programming languages, including an object oriented programminglanguage such as Smalltalk. C++, or the like, and procedural programminglanguages, such as the “C” programming language or similar programminglanguages. The computer readable program instructions may executeentirely on the user's computer, partly on the user's computer, as astand-alone software package, partly on the user's computer and partlyon a remote computer or entirely on the remote computer or server. Inthe latter scenario, the remote computer may be connected to the user'scomputer through any type of network, including a local area network(LAN) or a wide area network (WAN), or the connection may be made to anexternal computer (for example, through the Internet using an InternetService Provider). In some embodiments, electronic circuitry including,for example, programmable logic circuitry, field-programmable gatearrays (FPGA), or programmable logic arrays (PLA) may execute thecomputer readable program instructions by utilizing state information ofthe computer readable program instructions to personalize the electroniccircuitry, in order to perform aspects of the present invention.

Aspects of the present invention are described herein with reference toflowchart illustrations and/or block diagrams of methods, apparatus(systems), and computer program products according to embodiments of theinvention. It will be understood that each block of the flowchartillustrations and/or block diagrams, and combinations of blocks in theflowchart illustrations and/or block diagrams, can be implemented bycomputer readable program instructions.

These computer readable program instructions may be provided to aprocessor of a general purpose computer, special purpose computer, orother programmable data processing apparatus to produce a machine, suchthat the instructions, which execute via the processor of the computeror other programmable data processing apparatus, create means forimplementing the functions/acts specified in the flowchart and/or blockdiagram block or blocks. These computer readable program instructionsmay also be stored in a computer readable storage medium that can directa computer, a programmable data processing apparatus, and/or otherdevices to function in a particular manner, such that the computerreadable storage medium having instructions stored therein comprises anarticle of manufacture including instructions which implement aspects ofthe function/act specified in the flowchart and/or block diagram blockor blocks.

The computer readable program instructions may also be loaded onto acomputer, other programmable data processing apparatus, or other deviceto cause a series of operational steps to be performed on the computer,other programmable apparatus or other device to produce a computerimplemented process, such that the instructions which execute on thecomputer, other programmable apparatus, or other device implement thefunctions-acts specified in the flowchart and/or block diagram block orblocks.

The flowchart and block diagrams in the Figures illustrate thearchitecture, functionality, and operation of possible implementationsof systems, methods, and computer program products according to variousembodiments of the present invention. In this regard, each block in theflowchart or block diagrams may represent a module, segment, or portionof instructions, which comprises one or more executable instructions forimplementing the specified logical function(s). In some alternativeimplementations, the functions noted in the blocks may occur out of theorder noted in the Figures. For example, two blocks shown in successionmay, in fact, be executed substantially concurrently, or the blocks maysometimes be executed in the reverse order, depending upon thefunctionality involved. It will also be noted that each block of theblock diagrams and/or flowchart illustration, and combinations of blocksin the block diagrams and/or flowchart illustration, can be implementedby special purpose hardware-based systems that perform the specifiedfunctions or acts or carry out combinations of special purpose hardwareand computer instructions.

What is claimed:
 1. A system for proactively responding to an anomaly in a chaotic environment, comprising: a computing device in communication with a set of electronic sensors, the electronic sensors being configured to report one or more values in the chaotic environment that undergo pseudo-Brownian change during a first status of the chaotic environment and do not undergo pseudo-Brownian change during a second status of the chaotic environment, and the computing device comprising a processor, and non-transitory memory storing instructions that, when executed by the processor, cause the processor to: receive a first set of sensor readings during the first status; based on the first set of sensor readings, establish an expected range of the one or more values during a future time window; receive a second set of sensor readings comprising a value outside of the expected range; determine that the chaotic environment has entered the second status; and transmit, to one or more remote devices that interact with the chaotic environment, instructions to activate a physical appliance that acts upon the chaotic environment until sensor readings indicate that the chaotic environment has re-entered the first status.
 2. The system of claim 1, wherein the expected range is determined based at least in part on a bipower variation calculated from the first set of sensor readings.
 3. The system of claim 1, wherein the expected range is determined based at least in part on a predetermined probability such that future sensor readings of the one or more values will fall within the expected range at at least the predetermined probability in the absence of an active interference in the chaotic environment.
 4. The system of claim 1, wherein the one or more remote devices act by preventing a network message from being transmitted through a network.
 5. The system of claim 1, wherein the one or more remote devices act by generating a message for receipt by a human user.
 6. The system of claim 1, wherein the one or more remote devices act by activating an alarm visible or audible to a human user.
 7. The system of claim 1, wherein the instructions, when executed by the processor, further cause the processor to: expand the expected range based at least in part on the value outside the expected range.
 8. The system of claim 1, wherein the instructions, when executed by the processor, further cause the processor to: narrow the expected range based at least in part on a third set of sensor readings indicating that the one or more values are within the expected range.
 9. The system of claim 1, wherein the chaotic environment enters the second status in response to a computer malfunction transmitting messages that influence values within the chaotic environment.
 10. A computer-implemented method for proactively responding to an anomaly in a chaotic environment, comprising: receiving a first set of sensor readings of one or more values in the chaotic environment from a set of electronic sensors during a first status of the chaotic environment, wherein the one or more values undergo pseudo-Brownian change during a first status of the chaotic environment and do not undergo pseudo-Brownian change during a second status of the chaotic environment; based on the first set of sensor readings, establishing an expected range of the one or more values during a future time window; receiving a second set of sensor readings comprising a value outside of the expected range; determining that the chaotic environment has entered the second status; and transmitting, to one or more remote devices that interact with the chaotic environment, instructions to activate a physical appliance that acts upon the chaotic environment until sensor readings indicate that the chaotic environment has re-entered the first status.
 11. The method of claim 10, wherein the expected range is determined based at least in part on a bipower variation calculated from the first set of sensor readings.
 12. The method of claim 10, wherein the expected range is determined based at least in part on a predetermined probability such that future sensor readings of the one or more values will fall within the expected range at at least the predetermined probability in the absence of an active interference in the chaotic environment.
 13. The method of claim 10, wherein the one or more remote devices act by preventing a network message from being transmitted through a network.
 14. The method of claim 10, wherein the one or more remote devices act by generating a message for receipt by a human user.
 15. The method of claim 10, wherein, the one or more remote devices act by activating an alarm visible or audible to a human user.
 16. The method of claim 10, further comprising: expanding the expected range based at least in part on the value outside the expected range.
 17. The method of claim 10, further comprising: narrowing the expected range based at least in part on a third set of sensor readings indicating that the one or more values are within the expected range.
 18. The method of claim 10, wherein the chaotic environment enters the second status in response to a computer malfunction transmitting messages that influence values within the chaotic environment. 